Publish dual-architecture macOS releases

[davejohnson]

What changed

• add a guarded one-command npm run release -- patch flow
• build native Apple Silicon and Intel DMGs on matching GitHub-hosted runners
• gate npm publication on package validation and both installer builds
• generate SHA-256 checksums and publish all four assets to a public GitHub Release
• document the release command, download link, architecture choice, and current ad-hoc-signing caveat

Why

PR #16 merged the 0.1.1 version bump before its later release-automation commits reached the branch. As a result, main still has the old package-only workflow and cannot create downloadable DMG releases.

Impact

After this merges, npm run release -- patch from clean, current main validates, commits, tags, atomically pushes, watches npm publication, builds arm64 and x86_64 installers, and creates the public GitHub Release.

Validation

• 106 Vitest files and 913 tests passed
• TypeScript typecheck and production build passed
• package safety check passed
• 30 Swift tests passed
• full simulated 0.1.2 release commit/tag/atomic push passed against a local bare remote
• GitHub parsed the workflow from the branch
• checksum creation and verification passed against the existing DMG